The Agent Skills Directory

[SAFE]: No malicious patterns detected. The skill performs legitimate project-level setup operations such as copying scripts and updating the .gitignore file.
[PROMPT_INJECTION]: The skill implements an orchestration pattern where it reads task instructions from project files (TERMINAL-PROMPTS.md). This creates a surface for indirect prompt injection if those files contain untrusted content.
Ingestion points: Reads prompts and task status from docs/tasks/**/TERMINAL-PROMPTS.md and 00-overview.md.
Boundary markers: Uses a static system prompt prefix to define worker constraints and execution rules.
Capability inventory: Workers have access to a defined Bash allowlist including git, gh, npm, and file system operations.
Sanitization: Uses awk to parse markdown headers and extract fenced code blocks for prompt delivery.
[COMMAND_EXECUTION]: The skill uses local shell scripts to manage git worktrees and spawn headless AI sessions. These operations are restricted to the current project directory and follow standard development practices.

local-waves